feat: support Argo CD Git auth modes - #388
Open
Matthiator wants to merge 9 commits into
Open
Conversation
tuunit
requested changes
Jun 12, 2026
Address review feedback: - introduce v1alpha2 config version and migrate v1alpha1 configs through an explicit version check instead of shape detection - move the argocd.repo.https -> argocd.repo.git migration into the v1alpha1 -> v1alpha2 migration - remove the terraform.dns block: the zone name is derived from the cluster dnsName, the contact email moves to terraform.dnsContactEmail
Re-port the Argo CD Git auth-modes feature onto main's refactored config architecture: - express the argocd.repo.https->git rename and terraform.dns->dnsContactEmail change as a new v1alpha3->v1alpha4 migration in the migrations/ package (the branch's inline v1alpha2 approach collided with main's already-shipped v1alpha2/v1alpha3 layout migration) - apply the auth modes (https/ssh/github-app) to RepoProto, envconfig, createGitRepositorySecret, factory and orchestrator - keep main's public-repo support (https username/PAT stay optional) - update argo-cd values + stackit/t-cloud-public tfvars templates to repo.git and cluster.dnsName / terraform.dnsContactEmail - adapt tests to the new schema and add auth-mode + v1alpha4 migration coverage
Contributor
|
needs to be split into 2 PRs. one for the go code and the template changes need to go into the catalogs repository |
15 tasks
Contributor
Author
|
Done: this PR now contains only the Go/config, migration, CI, and documentation changes. The catalog templates were moved to kubara-io/catalogs#6. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 Summary
Adds mode-aware Argo CD Git repository authentication and updates the configuration schema on top of the external catalog architecture merged in #515.
https,ssh, andgithub-appthroughARGOCD_GIT_AUTH_MODEARGOCD_GIT_URLwhile retainingARGOCD_GIT_HTTPS_URLas the legacy HTTPS fallbackargocd.repo.gitand retains OCI repository supportterraform.dnsContactEmailBecause #515 introduced config version
v1alpha4, this PR now introducesv1alpha5. Thev1alpha4tov1alpha5migration movesargocd.repo.httpstoargocd.repo.git, movesterraform.dns.emailtoterraform.dnsContactEmail, derives the zone name fromcluster.dnsName, and warns if the former DNS names differ. Existing migrations continue to run in sequence.Catalog templates are intentionally excluded from this PR and moved to kubara-io/catalogs#6.
🧩 Type of change
Supported older configurations are migrated automatically when kubara loads and saves them.
🧪 Testing
Validated with the full Go test suite, static analysis, CodeQL, strict documentation validation, catalog-backed init/generate, Helm validation, and Terraform validation.
🔗 Related Issues / Tickets
Closes #246
Related to kubara-io/catalogs#6
✅ Checklist
📎 Additional Context (optional)
The matching catalog release is prepared in kubara-io/catalogs#6. Until version 1.1.0 is published, CI packages that branch locally; the workflow contains a TODO to remove this temporary bridge after publication.